Bagisto Cross-Site Scripting Vulnerability in Custom Scripts Handler

A cross-site scripting (XSS) vulnerability has been identified in Bagisto versions through 2.3.15. The issue arises in the Custom Scripts Handler component, where the application fails to properly sanitize user input before rendering it. This allows authenticated low-privileged administrative users to inject arbitrary JavaScript, which is then executed in the browsers of users visiting the affected pages. The vulnerability can be exploited remotely, and a public proof-of-concept is available.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, an authenticated low-privileged admin user can navigate to the Custom Scripts configuration feature. Once there, the user can inject a JavaScript payload into the Custom Scripts field. After saving the configuration, the injected script will execute automatically in the browsers of users accessing the affected pages.